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In the Claiius: 



1. 



(Original) A method for detennining a point of loss for data records to 



be communicated between a source and a destination on a communication network, 
the method comprising the steps of: 

determining a topology of the communication network between the source and the 
destination^ the topology including a plurality of connecting nodes; 

monitoring a number of data records from the source directed to the destination 
passing between ones of the connecting nodes during a determined period of time; and 

identifying at least one of the connecting nodes as the point of loss based on the 
monitored number of data records and the determined topology. 

2. (Original) The method of Claim 1 wherein a plurality of network appliances 
configured to obtain a number of data records passing between a pair of connecting nodes 
diuing a time period are positioned between respective ones of the connecting nodes, and 
wherein the monitoring step further comprises the steps of: 

identifying at least one of the network appliances on the topology^, and 
obtaining the number of data records from the source directed to the destination 

obtained by the identified at least one network appliance during the determined period of 

time. 

3. (Original) The method of Claim 2 wherein the steps of identifying at least one 
of the network appliances on the topology and obtaining the number of data records from the 
source directed to the destination obtained by the identified at least one network appliance 
during the determined period of time further comprise the steps of: 

identifying at least one first hop one of the network appliances which is coupled to the 
source over the commxmication network; 

identifying at least one next hop one of the network appliances which is coupled 
between the at least one first hop one of the network appliances and the destination; 

obtaining a number of data records from the source directed to the destination 
obtained by the at least one first hop one of the network appliances and the at least one next 
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hop one of the network appliances during the deteimiaed time period; and 

wherein the step of identifying at least one of the connecting nodes as the point of loss 
further comprises the steps of: 

comparing the number of data records from the source directed to the destination 
obtained by one of the at least one first hop one of the network appliances with the number of 
data records from the source directed to the destination obtained by ones of the at least one 
next hop one of the network appliances coupled between the one of the at least one firet hop 
one of the network appliances and the destination; and 

identifying a connecting node positioned between the at least one first hop one of the 
network appliances and the ones of the at least one next hop one of the network appliances as 
the point of loss for data records if the number of data records from the source directed to the 
destination obtained by one of the at least one first hop one of the network appliances differs 
by a threshold amount from the number of data records &om the source directed to the 
destination obtained by ones of the at least one next hop one of the network appliances 
coupled between the one of the at least one first hop one of the network appliances and the 
destination. 

4. (Original) The method of Claim 3 wherein the at least one first hop one of the 
network appliances is coupled to the source without intervening ones of the network 
appliances being coupled between the source and the first hop one of the network appliances 
and wherein the at least one next hop one of the network appliances is coupled between the at 
least one first hop one of the network appliances and the destination without intervenixig ones 
of the network appliances being coupled between the at least one first hop one of the network 
appliances and the at least one next hop one of the network appliances. 

5. (Original) The method of Claim 3 wherein the step of comparing the munber 
of data records from the source directed to the destination obtained by one of the at least one 
first hop one of the network appliances with the number of data records from the source 
directed to the destination obtained by ones of the at least one next hop one of the network 
apphances coupled between the one of the at least one first hop one of the network appliances 
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and the destination further comprises the step of comparing a number of data records from the 
source directed to the destination obtained by an upstream one of the network appliances with 
a number of data records from the source directed to the destination obtained by at least one 
downstream one of the network appliances coupled between the upstream one of the network 
appliances and the destination at an adjacent downstream position for successive ones of the 
network appliances until at least one of the destination is reached or at least one of the 
connecting nodes is identified as the point of loss for data records and wherein the step of 
identifying a connecting node positioned between the at least one first hop one of the network 
appliances and the ones of the at least one next hop one of the network apphances as the point 
of loss for data records comprises the step of identifying a connecting node positioned 
between the upstream one of the network appliances and corresponding downstream ones of 
the network appliances as the point of loss for data records if the number of data records from 
the source directed to the destination obtained by the upstream one of the network appliances 
differs by a threshold amount from the number of data records from the source directed to the 
destination obtained by the corresponding downstream ones of the network appliances. 

6. (Original) The method of Claim 5 wherein the step of comparing a number of 
data records fix)m the source directed to the destination obtained by an upstream one of the 
network apphances with a nxunber of data records from the source directed to the destination 
obtained by at least one downstream one of the network appliances coupled between the 
upstream one of the network apphances and the destination at an adjacent downstream 
position is repeated for successive ones of the network appliances on the topology until the 
destination is reached and wherein the step of identifying at least one of the connecting nodes 
as the point of loss fiirther comprises the step of identifying all connecting nodes positioned 
between upstream ones of the network appliances and corresponding downstream ones of the 
network s^pliances as points of loss for data records if the number of data records from the 
source directed to the destination obtained by respective upstream ones of the network 
appliances differs by a threshold amount fk>m the number of data records from the source 
directed to the destination obtained by corresponding downstream ones of the network 
appliances. 
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7, (Original) The method of Claim 3 further comprising the step of adjusting 
obtained txumbers of data records firom the source directed to the destination to compensate 
for in transit introduced changes to data records before comparing the number of data records 
from the source directed to the destination obtained by one of the at least one first hop one of 
the network apphances with the number of data records from the source directed to the 
destination obtained by ones of the at least one next hop one of the network appliances 
coupled between the one of the at least one first hop one of the netwoik appliances and the 
destination, 

8, (Original) The method of Claim 7 wherein the step of adjusting obtained 
numbers of data records comprises the step of adjusting obtained numbers of data records 
firom the source directed to the destination to compensate for encryption related changes in 
data records introduced by a connecting node coupled between the a first hop one and at least 
one next bop one of the network appliances. 

9, (Original) The method of Claim 3 further comprising the step of deftning the 
determined period of time for the at least one first hop one of the network appliances and the 
at least next hop one of the network appliances based on a delay between the at least one first 
hop one of the network appliances and the at least next hop one of the network appliances. 



10. (Original) The method of Claim 9 wherein the step of defining the determined 
time period further comprises the step of defining the determined period of time for the at 
least one first hop one of the network appliances and the at least next hop one of the network 
appliances based on an average delay between the at least one first hop one of the network 
appliances and the at least next hop one of the network appliances determined over an 
averaging window. 

1 1 . (Original) The method of Claim 3 further comprising the step of defining the 
threshold amount based on an expected timing related variability between numbers of data 



Received from < 919 854 1401 > at 8/14/03 1:16:39 PM [Eastern Daylight Time] 



AUG. 14. 2003 1:09PM 



IB^S 



MBS&S 91 9 854- 140'^ 



NO. 9549 P. 7/26 



In re: Kenneth Lee Harper 
Serial No. 09/641,045 
Filed: August 17, 2000 
Page 6 of 25 

records obtained by ones of the network appliances. 



12. (Original) The method of Claim 1 1 wherein the step of defming the threshold 
amount further comprises the step of defining the threshold amount based on a percentage of 
data record throughput for respective ones of the network appliances. 

13. (Original) The method of Claim 3 wherein the connecting nodes are routing 
devices selected from the group consisting of routers, bridges and switches. 




14. (Origiiial) The method of Claim 3 wherein a network appliance is positioned 
between each defined connecting node in the topology and all other adjacent defined 
connecting nodes in the topology. 



1 5. (Original) The method of Claim 14 wherein at least one of the defined 
connecting nodes comprises a plurality of routing devices. 

1 6. (Original) A system for determining a point of loss for data records to be 
conunimicated between a source and a destination on a communication network, the system 
comprising: 

a memory including a topology of the communication network between the source and 
the destination, the topology including a plurality of connecting nodes; 

a receiver that receives from a plurality of network appliances at determined locations 
on the communication network a number of data records from the source directed to the 
destination passing between ones of the connecting nodes during a determined period of time; 
and 

a comparison circuit that identifies at least one of the connecting nodes as the point of 
loss based on the received number of data records, the locations of the network ^pliances 
and the topology. 

17. (Original) The system of Claim 16 further comprising the plurality of network 
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appliances wherein pairs of the connecting nodes defme segments of the topology between 
the source and the destination and wherein at least one of the network appliances is coupled 
between each of the pairs of the connecting nodes. 

1 8. (Original) The system of Claim 17 wherein at least one of the network 
apphances fiirther comprises: 

atimei^ 

a filter that identifies ones of a plurality of data records detected by the at least one of 
the network appliances that are being transmitted firom the source to the destination on the 
communications network; 

a counter that counts filtered one of the plurality of data records, the counter being 
configured to be reset responsive to the timer; and 

a transmitter that transmits counts firom the counter to the receiver. 

19. (Original) The system of Claim 17 wherein the filter is configured to identify 
ones of the plurality of data records based on the source Internet Protocol (IP) address and 
destination IP address of a data packet containing data records detected by the at least one of 
the network appliances. 

20. (Original) A system for determining a point of loss for data records to be 
communicated between a source and a destination on a communication network, the 
system comprising; 

means for determining a topology of the communication network between the source 
and the destination, the topology including a plurality of connecting nodes; 

means for monitoring a number of data records firom the source directed to the 
destination passing between ones of the connecting nodes during a determined period of time; 
and 

means for identifying at least one of the connecting nodes as the point of loss based on 
the monitored number of data records and the determined topology. 
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2 1 . (Currently Amended) The system of Claim 2Q further comprising: 

a plurality of network appliances configured to obtain a number of data records 
passing between a pair of connecting nodes during a time period, ones of the network 
appliances being positioned between respective ones of the connecting nodes; 

wherein the means for monitoring fiirther comprises: 

means for identifying at least one of the network appliances on the topology; and 
means for obtaining the number of data records from the source directed to the 

destination obtained by the identified at least one network appliance during the deteonined 

period of time. 

22. (Original) The system of Claim 2 1 wherein the means for identifying at least 
one of the networic appliances on the topology and the means for obtaining the number of data 
records fiom the source directed to the destination obtained by the identified at least one 
network appliance during the determined period of time further comprise: 

means for identifying at least one first hop one of the network appliances which is 
coupled to the source over the communication network; 

means for identifying at least one next hop one of the network appliances which is 
coupled between the at least one first hop one of the network appliances and the destination; 

means for obtaining a number of data records from the source directed to the 
destination obtained by the at least one first hop one of the network appliances and the at least 
one next hop one of the network appliances during the determined time period; and 

wherein the means for identifying at least one of the connecting nodes as the point of 
loss further comprises: 

means for comparing the number of data records from the source directed to the 
destination obtained by one of the at least one first hop one of the network appliances with the 
number of data records from the source directed to the destination obtained by ones of the at 
least one next hop one of the network appliances coupled between the one of the at least one 
first hop one of the network appliances and the destination; and 

means for identifying a connecting node positioned between the at least one first hop 
one of the network appliances and the ones of the at least one next hop one of the network 
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appliances as the point of loss for data records if the number of data records from the source 
directed to the destination obtained by one of the at least one first hop one of the network 
appliances differs by a threshold amount from the number of data records from the source 
directed to the destination obtained by ones of the at least one next hop one of the network 
appliances coupled between the one of the at least one first hop one of the network appliances 
and the destination. 




23, (Original) The system of Claim 22 wherein the at least one first hop one of the 
network appliances is coupled to the source without intervening ones of the network 
appliances being coupled between the source and the first hop one of the network appliances 
and wherein the at least one next hop one of the network appliances is coupled between the at 
least one first hop one of the network appliances and the destination without intervening ones 
of the network appliances being coupled between the at least one first hop one of the network 
appliances and the at least one next hop one of the network appliances. 

24. (Original) The system of Claim 22 wherein the means for comparing the 
number of data records fi-om the source directed to the destination obtained by one of the at 
least one first hop one of the network appliances with the numb^ of data records from the 
source directed to the destination obtained by ones of the at least one next hop one of the 
network appliances coupled between the one of the at least one first hop one of the network 
appliances and the desthiation flirther comprises means for comparing a number of data 
records Srom the source directed to the destination obtained by an upstream one of the 
network appliances with a number of data records from the source directed to the destination 
obtained by at least one downstream one of the network appliances coupled between the 
upstream one of the network appliances and the destination at an adjacent downstream 
position for successive ones of the network appliances imtil at least one of the destination is 
reached or at least one of the connecting nodes is identified as the point of loss for data 
records and wherein the means for identifying a connecting node positioned between the at 
least one first hop one of the network appliances and the ones of the at least one next hop one 
of the network appliances as the point of loss for data records comprises means for 
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identifying a connecting node positioned between the upstream one of the network appUances 
and corresponding downstream ones of the network appliances as the point of loss for data 
records if the number of data records from the source directed to the destination obtained by 
the upstream one of the network appliances differs by a threshold amount from the number of 
data records from the source directed to the destination obtained by the corresponding 
downstream ones of the network appliances. 

25- (Original) The system of Claim 24 wherein the means for comparing a number 
of data records from the soiu^e directed to the destination obtained by an upstream one of the 
network appliances with a number of data records from the source directed to the destination 
obtained by at least one downstream one of the network appliances coupled between the 
upstream one of the network appliances and the destination at an adjacent downstream 
position is configured to compare successive ones of the network appliances on the topology 
until the destination is reached and wherein the means for identifying at least one of the 
connecting nodes as the point of loss further comprises means for identifying all connecting 
nodes positioned between upstream ones of the network appliances and corresponding 
downstream ones of the network appliances as points of loss for data records if the number of 
data records from the soxxrce directed to the destination obtained by respective upstream ones 
of the network appliances differs by a threshold amount from the number of data records from 
the source directed to the destination obtained by corresponding downstream ones of the 
network appliances. 

26 (Original) The system of Claim 22 further comprising means for adjusting ■ 
obtained numbers of data records from the source directed to the destination to compensate 
for in transit introduced changes to data records before comparing the number of data records 
from the source directed to the destination obtained by one of the at least one first hop one of 
the network appliances with the number of data records from the source directed to the 
destination obtained by ones of the at least one next hop one of the network appUances 
coupled between the one of the at least one first hop one of the network appliances and the 
destination. 
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27. (Original) The system of Claim 26 wherein the means for adjusting obtained 
numbers of data records comprises means for adjusting obtained numbers of data records 
from the source directed to the destination to compensate for encryption related changes in 
data records introduced by a connecting node coupled between the a first hop one and at least 
one next hop one of the network appliances. 

28. (Original) The system of Claim 22 further comprising means for defining the 
determined period of time for the at least one first hop one of the network appliances and the 
at least next hop one of the network appliances based on a delay between the at least one first 
hop one of the network appliances and the at least next hop one of the network appliances. 

29. (Original) The system of Claim 28 wherein the means for defining the 
determined time period further comprises means for defining the determined period of time 
for the at least one first hop one of the network appliances and the at least next hop one of the 
network appliances based on an average delay between the at lezist one first hop one of the 
network appliances and the at least next hop one of the network appliances determined over 
an averaging window.- 

30. (Original) The system of Claim 22 further comprising means for defining the 
threshold amount based on an expected timing related variability between numbers of data 
records obtained by ones of the network appliances. 

3 1 . (Original) The system of Claim 3 0 wherein the means for defining the 
threshold amotmt further comprises means for defining the threshold amount based on a 
percentage of data record throughput for respective ones of the network appliances. 

32. (Original) The system of Claim 22 wherein the connecting nodes are routing 
devices selected from the group consisting of routers, bridges and switches. 
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33. (Original) The system of Claim 22 wherein a network ^pliance is positioned 
between each defined connecting node in the topology and all other adjacent defined 
connecting nodes in the topology. 

34. (Original) The system of Claim 33 wherein at least one of the defined 
connecting nodes comprises a plurality of routing devices. 

35. (Original) A computer program product for determining a point of loss for data 
records to be communicated between a source and a destination on a communication network 
based on a topology of the commxinication network between the soxirce and the destination, 
the topology including a plurality of connecting nodes, the computer program product 
comprising: 

a computer-readable storage medium having computer-readable program code 
embodied in said medium, said computer-readable program code comprising: 

computer-readable program code which monitors a nimiber of data records from the 
source directed to the destination passing between ones of the connecting nodes during a 
determined period of time; and 

computer-readable program code which identifies at least one of the connecting nodes 
as the point of loss based on the monitored number of data records and the determined 
topology. 

36. (Original) The computer program product of Claim 35 wherein a plurality of 
network appliances configured to obtain a number of data records passing between a pair of 
connecting nodes during a time period are positioned between respective ones of the 
connecting nodes, wherein the computer-readable program code which monitors further 
comprises: 

computer-readable program code which identifies at least one of the network 
appliances on the topologj^, and 

computer-readable program code which obtains the number of data records fix)m the 
source directed to the destination obtained by the identified at least one network appliance 
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during the determined period of time. 



37. (Original) The computer program product of Claim 36 wherein the computer- 
readable program code which identifies at least one of the network appliances on the topology 
and the computer-readable program code which obtains the number of data records from the 
source directed to the destination obtained by the identified at least one network appliance 
during the determined period of time fiuther comprise: 

computer-readable program code which identifies at least one first hop one of the 
network appliances which is coupled to the source over the communication network; 

computer-readable program code which identies at least one next hop one of the 
network appliances which is coupled between the at least one first hop one of the network 
appliances and the destination; 



computer-readable program code which obtains a number of data records from the 
source directed to the destination obtained by the at least one first hop one of the network 
appliances and the at least one next hop one of the network appliances during the determined 
time period; and 

wherein the computer-readable program code which identifies at least one of the 
connecting nodes as the point of loss fiirther comprises: 

computer-readable program code which compares the number of data records from the 
source directed to the destination obtained by one of the at least one first hop one of the 
network appliances with the number of data records from the source directed to the 
destination obtained by ones of the at least one next hop one of the network appliances 
coupled between the one of the at least one first hop one of the network appliances and the 
destination; and 

computer-readable program code which identifies a connecting node positioned 
between the at least one first hop one of the network appliances and the ones of the at least 
one next hop one of the network appliances as the point of loss for data records if the number 
of data records from the source directed to the destination obtained by one of the at least one 
first hop one of the network appliances differs by a threshold amount fiom the number of data 
records from the source directed to the destination obtained by ones of the at least one next 
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hop one of the network appliances coupled between the one of the at least one first hop one of 
the network appliances and the destination. 




38- (Original) The computer program product of Claim 37 wherein the at least one 
first hop one of the network appliances is coupled to the source without intervening ones of 
the network appliances being coupled between the source and the first hop one of the network 
appliances and wherein the at least one next hop one of the network appliances is coupled 
between the at least one first hop one of the network appliances and the destination without 
intervening ones of the network appliances being coupled between the at least one first hop 
one of the network appliances and the at least one next hop one of the network appliances.. 

39. (Original) The computer program product of Claim 37 wherein the computer- 
readable program code which compares the number of data records fi-om the source directed 
to the destination obtained by one of the at least one first hop one of the network ^pliances 
with the number of data records from the source directed to the destination obtained by ones 
of the at least one next hop one of the network appliances coupled between the one of the at 
least one first hop one of the network appUances and the destination flirther comprises 
computer-readable program code which compares a number of data records firom the source 
directed to the destination obtained by an upstream one of the network appliances with a 
number of data records firom the source directed to the destination obtained by at least one 
downstream one of the network appliances coupled between the upstream one of the network 
appliances and the destination at an adjacent downstream position for successive ones of the 
network appliances until at least one of the destination is reached or at least one of the 
connecting nodes is identified as the point of loss for data records and wherein the computer- 
readable program code which identifies a connecting node positioned between the at least one 
first hop one of the network appliances and the ones of the at least one next hop one of the 
network appliances as the point of loss for data records comprises computer-readable 
program code which identifies a cormecting node positioned between the upstream one of the 
network apphances and corresponding downstream ones of the network appliances as the 
point of loss for data records if the number of data records fi-om the source directed to the 
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destination obtained by the upstream one of the network apphances differs by a threshold 
amount from the number of data records from the source directed to the destination obtained 
by the con^sponding downstream ones of the network appliances. 

40. (Original) The computer program product of Claim 39 wherein the computer- 
readable program code which compares a number of data records from the source directed to 
the destination obtained by an upstream one of the network appliances with a number of data 
records from the source directed to the destination obtained by at least one downstream one of 
the network appliances coupled between the upstream one of the network appliances and the 
destination at an adjacent downstream position compares successive ones of the netwoiic 
appliances on the topology until the destination is reached and wherein the computer-readable 
program code which identifies at least one of the connecting nodes as the point of loss further 
comprises computer-readable program code which identifies all connecting nodes positioned 
between upstream ones of the network appliances and corresponding downstream ones of the 
network appliances as points of loss for data records if the number of data records from the 
source directed to the destination obtained by respective upstream ones of the network 
appliances differs by a threshold amount from the number of data records fix)m the source 
directed to the destination obtained by corresponding downstream ones of the network 
appliances. 

41 . (Original) The computer program product of Claim 37 further comprising 
computer-readable program code which adjusts obtained mmabers of data records from the 
source directed to the destination to compensate for in transit introduced changes to data 
records before comparing the number of data records €rom the source directed to the 
destination obtained by one of the at least one first hop one of the network apphances with the 
number of data records from the source directed to the destination obtained by ones of the at 
least one next hop one of the network appliances coupled between the one of the at least one 
first hop one of the network apphances and the destination, 

42. (Original) The computer program product of Claim 41 wherein the computer- 
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readable program code which adjusts obtained numbers of data records comprises computer- 
readable program code which adjusts obtained numbers of data records from the source 
directed to the destination to compensate for encryption related changes in data records 
iTltioduced by a connecting node coupled between the a first hop one and at least one next hop 
one of the network appliances. 

43. (Original) The computer program product of Claim 37 further comprising 
computer-readable program code which dejSnes the determined period of time for the at least 
one first hop one of the network appliances and the at least next hop one of the network 
apphances based on a delay between the at least one first hop one of the network appliances 
and the at least next hop one of the network appliances. 

44. (Original) The computer program product of Claim 43 wherein the computer- 
readable program code which defines the determined time period further comprises computer- 
readable program code which defines the determined period of time for the at least one first 
hop one of the network appliances and the at least next hop one of the network appliances 
based on an average delay between the at least one first hop one of the network apphances . 
and the at least next hop one of the network appliances determined over an averaging 
window. 

45. (Original) The computer program product of Claim 37 further comprising 
computer-readable program code which defines the threshold amount based on an expected 
timing related variability between numbers of data records obtained by ones of the network 
£^pliances. 

46. (Original) The computer program product of Claim 45 wherein the computer- 
readable program code which defines the threshold amount further comprises computer- 
readable program code which defines the threshold amount based on a percentage of data 
record throughput for respective ones of the network appliances. 
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47, (Original) The computer program product of Claim 37 wherein the connecting 
nodes are routing devices selected from the group consisting of routers, bridges and switches, 

48, (Original) The computer program product of Claim 37 wherein a network 
appliance is positioned between each defined connecting node in the topology and all other 
adjacent defmed connecting nodes in the topology. 

49, (Original) The computer program product of Claim 48 wherein at least one of 
the defined connecting nodes comprise a plurality of routing devices. 
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